Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

This smells more like a forgotten backdoor than an algorithmic flaw.... probably traceable in the commit log to the particular dev who put it in, and all the auditors who should have caught it, but didn't.

To put it in perspective, that $100K was for bypassing exploit mitigation features that cross all processes on the system, and would severely undermine Windows 8.1's security features. This one seems to require you to be standing in front of a specific console.

Sounds like a way to log in to any console, anywhere, at any time... but, the physical presence thing is some measure of containment. At least one five year old can't take down every machine on the planet at once.

Not very long ago that comment would have made me chuckle at the sheer absurdity of tossing a 5 year old hacker into prison, with recent cases such as the one of Aaron Swartz in mind it only bring a disillusioned smile to my lips.

On a side note, seriously Microsoft! that was one fucking cheap ass reward you came up with there, couple of games and a one year subscription. Do you actually want people to report bugs to you or do you want to encourage them to find a higher bidder, in this case an Indian street

I found a flaw in skype that allowed the dumping of usernames from regional nodes. I could run it on multiple threads and dump literally as high as 2048 per second (never tried with more threads...) Finding the other regional nodes wasn't exactly difficult.

There are surprisingly dark uses for that ability.

They sent me an Xbox 360 (this was less than a week before the Xbox one launch) bundle (kinect), 2 games, an Xbox Live Card, and a researcher acknowledgement on Technet (same as this kid) for August of 2013..I'm one of the "individual" entries with no link.

I did get invited to bluehat as well which was absolutely incredible, but I paid for the flight, hotel (at a discounted rate, at the Westin, Seattle!), etc.

It was a f*cking awesome conference.

Skype isn't cover by their bug bounty program, so they said they had nothing they could do. I was pretty insistent that I really needed the money, because I really really needed the money. That was a brief period in my life of spam sandwiches and ramen.

I'm not complaining, but I am saying if something isn't covered by their bounty program you're not going to get money from it.

The last person who asked me that turned out to actually work with skype at bluehat. The whole team came over and THEN told me who they were -_-.
I was just looking for a table with people who weren't anti-social, and one of the people happened to work for skype. Very very friendly people by the way.

Basically I was trying to get into a friends machine (we were doing a mini CTF) and as a joke he gave me the IP to a skype regional node.

I fuzzed said regional node and started getting really weird responses. I was trying a port that was open (same port as oracle..7776 I think?) Eventually I figured out that an arbitrary 4 bytes would result in a response with a plaintext string at the bottom of the packet.

My first thought was that my friend was running a gameserver, botnet, chat room, or really just something..weird.

Eventually I figured out they were skype usernames. Complete accident that I stumbled upon it. I'm only mentioning the details here because A) Microsoft knows exactly how I found it B) It's patched.

I believe it would have actually have had use as a DDoS amplification platform. The responses sent back were 50-90x the size of the request.

They never told me why this worked. The first engineer I had talked to asked one of them if it was an edge case, and the other shook his head "no," and aaaalmost said what it was. Then he noticed I wasn't an MS employee and said he couldn't tell me that.

Who takes shortcuts for code when you're developing a damned password entry system? I mean... really? When the sole purpose of the code is security, who goes "oh, whatever, we'll just match against whatever?"

You'd really have to go out of your way in a most bizarre manner to screw this up. I mean, this is like tell someone to make an omelette and they accidentally build a time-machine. What the heck were they doing here??

It's not that hard to do.Basically could bea) debug code for QA left in to bypass login

b) buffer overflow (off by one); and an exception thrown that was caught outside the password system; that exited back to the main run-time.Testing that your code can actually handle the maximum number of characters allowable by the input field, is... rarely tested by QA.I've personally crashed websites that don't restrcit the form input length on the password field. Apparently putting in 4096 character passers does ten

Not just PS, that's a common pattern in many scripting languages, especially shell scripts. Microsoft picked from the best (there's a number of bash-isms in Powershell, for example) when writing that thing.

The compiler really *should* complain about assignment in a test statement, because it's a really common error to make. Or you can remove that option entirely (make assignments valueless statements, in which case that's a syntax error and won't compile at all) but then A) you're forking the languages, and

No! No NO! This is an _extremely_ bad habit! The code looks like crap, but most importantly: you're changing the logical flow of the code. You're changing the way the code explains itself to the reader, which makes it harder to understand. It's like spelling errors in professional texts: it interrupts the flow of the reader.

ALL compilers nowadays warn about the assignment pattern. Try doing "if (i = 1)" in gcc or clang, for example, they'll insist you use double parenthesis around the assignment to explicit

I wonder...Either this is some developer/tester login thing.Or the developer did something weird were he removed whitespace, and a "correct" match was found when the manipulated/tested string was length 0.

It almost has to be a deliberate backdoor for testing that someone forgot to take out. I can't imagine "Trim()ing as password. But then I couldn't have believed anyone would smash case on a password before I heard Blizzard did it. I guess there's nothing so stupid that we should rule it out.

But this is not a keyboard/computer password. Allowances are made for less effective input devices. If extra spaces are a common problem when using Xbox text input, no one would think twice about it. Also, it is possible they just did not allow whitespace in a password, so instead of a warning they just removed it at creation and use (so it would work even if they thought your password has a space in it).

My online banking passwords are case insensitive too. And both banks explicitly said it's intentional and they aren't changing it.

Then again, my Australian bank account is protected by a password which must be exactly 6 characters, case insensitive, and cannot contain special characters of any kind. Oh, and must be entered by clicking static buttons on the page.

... the matching algo checks for zero length strings *before* it strips out whitespace so lets this through. Once it has stripped out this whitespace it *then* has a zero length string but doesn't know it and then the rest of the algo fails due to it.

As someone else suggested it's probably debug code that found its way into production. It's not a lack of skill problem it's a process problem, code reviews should have picked it up but obviously didn't, how it got as far as customers is the question MS should be asking.

There's no difference in my house. Where Win95 earned the hatred of geeks everywhere was for corporate office use, and it took MS forever in internet years to figure out the markets were so different - not until Win2000 did they have a sane OS for the business desktop.

Why is this criminal being celebrated rather than prosecuted for hacking into a protected computer system across state lines? The child is A FELON and must go to jail. The father acted as an accessory and should also be prosecuted.

I would however note that it's that curiosity to try stuff like this and that "what happens if I.." mindset that tends to make a good hacker. Yes this kid lucked out, but it's always encouraging when you see this kinda "poke holes in everything" behaviour early on.

I lucked out guessing a wifi password once. The neighbor's had put up a network and called it "harunyahya". I googled for it and came up with some wacky creationist conspiracy nut. One of the most common words on the site was 'truth'. So I used that as the password and got in on my first attempt.

A little bit research and a lot of luck. Pretty satisfying either way:)

This might have been a simple to find bug but that's exactly why it would have been so damaging. They could at least give the kid a permanent XBox Live subscription. He would have effectively had one if he hadn't disclosed the bug.

That's nothing. I've discovered flaws using quantum random input fuzzing on URLs that amounted to keys pounded on by a six month old baby.

The trick is not to disclose who discovered the flaw and breeched the security unless the Computer Fraud and Abuse Act is in play. If they come down on you, just point them to the private youtube video of an infant breeching their security and tell them it's only a matter of time before the babe randomly clicks the "make this video public" button.

I means what kind of code can allow a space password to be approved... the MD5 didn't surely checked... oh wait... another buffer overflow because the length of the password that too big? Why the space? It is a like a backdoor the developer forgot to removed?

Yeah. Space is a full blown character. This reeks of intentional backdoor, there's really no other plausible scenario in my mind.

That's not to say the backdoor was necessarily malicious. Maybe the guy in charge of the password login system was always breaking stuff and locking himself out of his box, so he put a bypass in there so he could get in an fix it, but forgot to remove it later. It's at best really sloppy.

Returning a boolean for password good bad, when the API returns false/zero for no error and nonzero error code for error is plausible.

MSDN is full of API documentation where the return value is counter intuitive, until you really consider the intent of the operation. So it is not outside the realm of possibility. I have had such problems myself using win32.

I actually debugged code where my C# sample was converted to vb, and the return value of ValidateCredentials was checked incorrectly after the conversion

What is this "second password verification screen"? Was it secondary identification questions (like mother's maiden name) or the same password again? I don't have an Xbox, so I have no idea what that means.

Given ac reply, they may be using a forgiving algo because it is not an actual password. I get irritated at security questions like favorite author, because did I enter first name, initial, or just surname? I'm curious if it can be bypassed using substrings as well.

I would not be surprised to find a forgiving check being financially more favorable than support calls.

Posting anonymous because I'm still afraid that pepsi goons will break down my door any minute now.

Quite a few years ago, I found that sombody had shown my preschooler that you could enter code numbers from inside the caps of pepsi products to get "free" merch.

He just started entering random numbers and characters until he found a pattern that worked every time. He thought that was the point! He spent hours at it and then proudly showed me that he'd "solved the puzzle" and Pepsi was going to send him truckloads of free stuff.

I quickly popped through a couple DHCPs on the cable modem and told him not to do that anymore.

"12. One of my advisors will be an average five-year-old child. Any flaws in my plan that he is able to spot will be corrected before implementation."

And:

"60. My five-year-old child advisor will also be asked to decipher any code I am thinking of using. If he breaks the code in under 30 seconds, it will not be used. Note: this also applies to passwords."

Perhaps Microsoft doesn't consider itself evil? Lots of people no longer do. At least they followed rule 32 in this case.

I have a "backdoor" branch on some of my git repos. After I merge the working branch into "master" I merge "master" into "backdoor". This allows me to keep backdoors out of the public distributable / viewable code which makes it into releases. The ease of in-place branch and merge in Git is one of its greatest strengths IMO. Even if I accidentally push the "backdoor" code to the public build system, it builds from a "main" branch and doesn't introduce the testing backdoors into the binaries.

This is more easily handled in Mercurial's queues system. You can keep a bunch of patches in a queue like that, and those patches will just be magically applied. It's pretty useful for a whole lot of situations.

It's not the first time Kristoffer has flashed his tech skills.“He’s figured out vulnerabilities 3 or 4 times,” said Davies.At age 1, Kristoffer got past the toddler lock screen on a cell phone by holding down the home key.

That entry on the list is worth more than them combined. Just think when li'l Krissy is looking for a job in ITSEC two decades from now and when asked for "how long he's been in the business", he'll be the first person in history to be able to fulfill the usual "no older than 25 with at least 20 years of experience" requirement.

A child will find bugs than an adult will miss, because an adult will only do reasonable things, while kids will try things that don't really make sense. Developers sometimes use little programs that just click things at random to try to catch these kinds of weird bugs, sometimes called "monkey testing."

"For discovering a multi-million dollar bug that would have required us to shut everything down until fixed, and probably reverted our databases by several days, you get almost nothing! Good day, sir!"

It actually is 21st century internet humor [knowyourmeme.com]. The "gorilla warfare" gave it away for me. You get a cookie for at least considering it could have been humor, unlike the other responders.